Is there any way how to get the IP address of CRL during the TLS handshake in air gap env?
Example:
- Do a simple curl request over HTTPS against app.contoso.com:
curl -v https://app.contoso.com listening on 20.20.10.1 which is whitelisted. But To allow communication by default we need to whitelist CRL (for example GoDaddy).
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0* Trying 20.20.10.1...
* TCP_NODELAY set
* Connected to app.contoso.com (20.20.10.1) port 443 (#0)
* schannel: SSL/TLS connection with app.contoso.com port 443 (step 1/3)
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 180 bytes...
* schannel: sent initial handshake data: sent 180 bytes
* schannel: SSL/TLS connection with app.contoso.com port 443 (step 2/3)
* schannel: failed to receive handshake, need more data
* schannel: SSL/TLS connection with app.contoso.com port 443 (step 2/3)
* schannel: encrypted data got 4096
* schannel: encrypted data buffer: offset 4096 length 4096
* schannel: encrypted data length: 4026
* schannel: encrypted data buffer: offset 4026 length 4096
* schannel: received incomplete message, need more data
* schannel: SSL/TLS connection with app.contoso.com port 443 (step 2/3)
* schannel: encrypted data got 934
* schannel: encrypted data buffer: offset 4960 length 5050
* schannel: sending next handshake data: sending 126 bytes...
0 0 0 0 0 0 0 0 --:--:-- 0:01:45 --:--:-- 0* schannel: SSL/TLS connection with app.contoso.com port 443 (step 2/3)
* schannel: failed to receive handshake, SSL/TLS connection failed
0 0 0 0 0 0 0 0 --:--:-- 0:01:45 --:--:-- 0
* Closing connection 0
* schannel: shutting down SSL/TLS connection with app.contoso.com port 443
* schannel: clear security context handle
curl: (35) schannel: failed to receive handshake, SSL/TLS connection failed
Process exited with code 35
From the request I can see 20.20.10.1 but I can't see the IP address of CRL which is communication trying to be opened:
* schannel: checking server certificate revocation
* schannel: sending initial handshake data: sending 180 bytes...
Any tips on how to get IP address of the CRL server during request? Is possible via curl or a different tool? I would like to avoid any low-level tools like Wireshark if possible. Thanks.
